Duty LXD-1318
Processes biometric data, in France
Each law's tag says when it binds: since in force proposed proposed
GDPR Article 9 Special Categories, as Implemented by Loi 78-17 Article 6since 2 lines
Regulation (EU) 2016/679, Art. 9; Loi n. 78-17, Art. 6 · Read the law's page
- Obtain an explicit GDPR Article 9(2) legal basis before processing biometric, health, or other special-category personal data of a person in France.
- Do not treat a photograph, video, or audio recording as processable merely because it is public; only the narrow Article 9(2)(e) self-disclosure exception applies to an identifier derived from it.
CNIL Standard Regulation on Workplace Biometric Access Control (Deliberation No. 2019-001)since 2 lines
CNIL Deliberation n. 2019-001 du 10 janvier 2019 portant reglement type relatif a la mise en oeuvre de dispositifs de controle d'acces biometrique · Read the law's page
- Run a data protection impact assessment and document why a less intrusive alternative was rejected before deploying a biometric access-control system for employees or building access in France.
- Do not rely on employee consent alone as the legal basis for a workplace biometric system; use a legal-obligation or legitimate-interest basis, or pair consent with a genuinely equivalent non-biometric alternative.
Projet de loi portant diverses dispositions d'adaptation au droit de l'Union européenne (DDADUE), Articles 24 to 24 terdecies, Authorities Competent Under the AI Actproposed4 lines
Articles 24 à 24 terdecies, texte adopté n° 63 (2025-2026), Sénat, 18 février 2026 (autorités compétentes, règlement sur l'intelligence artificielle) · Read the law's page
- This bill is not in force: the Sénat adopted it in first reading on and the Assemblée nationale has not adopted it. Read the lines below as what would apply if it is enacted as the Sénat's text stands.
- If you provide, import, distribute or deploy a high-risk AI system used as a safety component in the management and operation of critical infrastructure (digital infrastructure, road traffic, or the supply of water, gas, heating or electricity), comply with the AI Act obligations that the market surveillance authority designated for that domain by a Conseil d'État decree supervises (proposed Articles L. 1340-1 and L. 1340-2 of the Code de la défense).
- Carry out, within the time the authority sets, any measure it orders for a high-risk AI system used in critical infrastructure under proposed Article L. 1340-4 of the Code de la défense: ending the non-conformity, suspending or ceasing marketing or use, recalling or withdrawing the system, or publishing warnings (proposed Article L. 1340-5(V)).
- Where you are an economic operator concerned by the bringing into conformity, recall or withdrawal of a high-risk AI system that is a safety component of a product or equipment covered by Chapter VII of Title V of Book V of the Code de l'environnement, inform the other economic operators you supplied, and the operators and users of the system (Article 24 quater, 4°, b)).